@massu/core 1.10.8 → 1.12.1

package/src/detect/adapters/runner.ts

@@ -1,284 +0,0 @@
-// Copyright (c) 2026 Massu. All rights reserved.
-// Licensed under BSL 1.1 - see LICENSE file for details.
-
-/**
- * Plan 3b — Phase 1: AST adapter runner.
- *
- * Orchestrates: filter adapters via `matches()`, run them, isolate failures
- * via per-adapter try/catch (audit-iter-5 fix HH test (d)), and merge their
- * results.
- *
- * Confidence merge rule (spec §5):
- *   - 'high' / 'medium' / 'low' → field is written, with per-field provenance.
- *   - 'none' → field DROPPED (introspect's regex fallback may then emit it).
- *
- * AST-wins rule:
- *   - When the same conventions key appears in two adapters that BOTH return
- *     non-'none', the FIRST adapter (by source-list order) wins. This is
- *     deterministic — adapters are listed in `runner.ts`'s static array,
- *     never user-provided.
- */
-
-import { basename, relative } from 'path';
-import type {
-  AdapterResolved,
-  CodebaseAdapter,
-  DetectionSignals,
-  MergedAdapterOutput,
-  Provenance,
-  SourceFile,
-} from './types.ts';
-import { isParsableSource, MAX_AST_FILE_BYTES } from './parse-guard.ts';
-
-export interface RunAdaptersOptions {
-  /**
-   * Optional file sampler — given an adapter and the project root, returns
-   * the SourceFile[] the adapter should consume. If omitted, the runner
-   * passes an empty file list (useful in unit tests where the caller has
-   * already constructed adapters that don't need files).
-   */
-  sampleFiles?: (adapter: CodebaseAdapter, rootDir: string) => Promise<SourceFile[]> | SourceFile[];
-}
-
-/**
- * Run a static list of adapters against a project root.
- *
- * Per-adapter try/catch isolation: a single adapter throwing MUST NOT crash
- * the runner. The error is captured in `errored[]` and the runner continues.
- *
- * @param adapters - Static list of first-party adapters (no user-authored
- *   adapters at v1 — Plan 3c will add discovery).
- * @param rootDir - Absolute project root.
- * @param signals - Pre-built `DetectionSignals` (manifest reads, present
- *   dirs/files). Adapters consume these read-only.
- * @param options - Hooks for testing.
- */
-export async function runAdapters(
-  adapters: CodebaseAdapter[],
-  rootDir: string,
-  signals: DetectionSignals,
-  options: RunAdaptersOptions = {},
-): Promise<MergedAdapterOutput> {
-  const out: MergedAdapterOutput = {
-    byAdapter: {},
-    skipped: [],
-    errored: [],
-  };
-
-  // AST-wins / per-adapter merge:
-  // Each adapter writes to its own `detected.<adapter.id>` namespace, so
-  // global field collisions across adapters can't happen at the conventions
-  // level. The "AST-wins" rule in the spec applies at the introspector tier
-  // (regex fallback only fills fields the adapter returned 'none' for).
-  // Within a single adapter, if `conventions` repeats a key (shouldn't, but
-  // defensively), the first occurrence wins. For multiple adapters with the
-  // same id (shouldn't, but defensively), the first wins.
-
-  for (const adapter of adapters) {
-    if (out.byAdapter[adapter.id] || out.skipped.includes(adapter.id)) {
-      // Duplicate adapter id → skip the second one to preserve first-wins.
-      continue;
-    }
-    let matches: boolean;
-    try {
-      matches = adapter.matches(signals);
-    } catch (e) {
-      out.errored.push({
-        adapterId: adapter.id,
-        error: `matches() threw: ${e instanceof Error ? e.message : String(e)}`,
-      });
-      continue;
-    }
-    if (!matches) {
-      out.skipped.push(adapter.id);
-      continue;
-    }
-
-    let files: SourceFile[];
-    try {
-      files = options.sampleFiles
-        ? await options.sampleFiles(adapter, rootDir)
-        : [];
-    } catch (e) {
-      out.errored.push({
-        adapterId: adapter.id,
-        error: `sampleFiles threw: ${e instanceof Error ? e.message : String(e)}`,
-      });
-      continue;
-    }
-
-    // Phase 3.5 fix: size + depth + control-byte gate. Drop adversarial
-    // inputs BEFORE the adapter sees them — adapters trust this layer.
-    // Files dropped here are logged once per drop so operators see the
-    // signal; the adapter then runs against the surviving subset.
-    const safeFiles: SourceFile[] = [];
-    for (const f of files) {
-      const skip = isParsableSource(f.content, f.size);
-      if (skip) {
-        process.stderr.write(
-          `[massu/ast] WARN: skipping ${f.path} for adapter ${adapter.id}: ${skip.reason} (${skip.detail}). Cap=${MAX_AST_FILE_BYTES} bytes. (Phase 3.5 mitigation)\n`,
-        );
-        continue;
-      }
-      safeFiles.push(f);
-    }
-    files = safeFiles;
-
-    let result;
-    try {
-      result = await adapter.introspect(files, rootDir);
-    } catch (e) {
-      out.errored.push({
-        adapterId: adapter.id,
-        error: `introspect() threw: ${e instanceof Error ? e.message : String(e)}`,
-      });
-      continue;
-    }
-
-    // 'none' confidence drops the entire adapter result. The runner records
-    // that the adapter was attempted (in `byAdapter`) so callers can see it
-    // ran, but with empty conventions. introspect()'s regex fallback then
-    // takes over for the field.
-    if (result.confidence === 'none') {
-      out.byAdapter[adapter.id] = {
-        conventions: {},
-        _provenance: {},
-        confidence: 'none',
-      };
-      continue;
-    }
-
-    // Merge: keep first occurrence of each field (defensive against an
-    // adapter accidentally writing the same field twice).
-    const conventions: Record<string, unknown> = {};
-    const provenanceMap: Record<string, string> = {};
-    for (const [field, value] of Object.entries(result.conventions)) {
-      if (value === null || value === undefined) continue;
-      if (field in conventions) continue;
-      conventions[field] = value;
-    }
-    for (const p of result.provenance) {
-      if (p.field in provenanceMap) continue;
-      provenanceMap[p.field] = formatProvenance(p, rootDir);
-    }
-
-    const resolved: AdapterResolved = {
-      conventions,
-      _provenance: provenanceMap,
-      confidence: result.confidence,
-    };
-    out.byAdapter[adapter.id] = resolved;
-  }
-
-  return out;
-}
-
-function formatProvenance(p: Provenance, rootDir: string): string {
-  const rel = p.sourceFile.startsWith(rootDir + '/')
-    ? relative(rootDir, p.sourceFile)
-    : basename(p.sourceFile);
-  return `${rel}:${p.line} :: ${p.query}`;
-}
-
-// ============================================================
-// Signal builder — used by codebase-introspector to feed the runner
-// ============================================================
-
-import { existsSync, readdirSync, readFileSync, statSync } from 'fs';
-import { join } from 'path';
-
-/**
- * Build a `DetectionSignals` bundle by reading manifest files at the project
- * root. Cheap (one-level dir scan + a handful of file reads). Failures
- * degrade gracefully — a missing manifest just means that field is undefined.
- */
-export function buildDetectionSignals(rootDir: string): DetectionSignals {
-  const presentDirs = new Set<string>();
-  const presentFiles = new Set<string>();
-  try {
-    for (const entry of readdirSync(rootDir)) {
-      if (entry.startsWith('.')) continue;
-      try {
-        const st = statSync(join(rootDir, entry));
-        if (st.isDirectory()) presentDirs.add(entry);
-        else if (st.isFile()) presentFiles.add(entry);
-      } catch {
-        /* ignore */
-      }
-    }
-  } catch {
-    /* unreadable root → empty signals */
-  }
-
-  return {
-    packageJson: tryReadJson(join(rootDir, 'package.json')),
-    pyprojectToml: tryReadToml(join(rootDir, 'pyproject.toml')),
-    gemfile: tryReadString(join(rootDir, 'Gemfile')),
-    cargoToml: tryReadToml(join(rootDir, 'Cargo.toml')),
-    goMod: tryReadString(join(rootDir, 'go.mod')),
-    mixExs: tryReadString(join(rootDir, 'mix.exs')),
-    csproj: tryReadFirstCsproj(rootDir, presentFiles),
-    pomXml: tryReadString(join(rootDir, 'pom.xml')),
-    gradleBuild: tryReadGradleBuild(rootDir, presentFiles),
-    presentDirs,
-    presentFiles,
-  };
-}
-
-/**
- * Find the first `.csproj` file at the project root (sorted alphabetically
- * for determinism) and return its raw XML content. Returns undefined if
- * none exist. Multi-project solutions where the root has no top-level
- * .csproj (the `.sln` lives at root and projects are in subdirs) get
- * `csproj=undefined` — adapters then degrade per their own logic.
- */
-function tryReadFirstCsproj(rootDir: string, presentFiles: Set<string>): string | undefined {
-  const csprojNames = [...presentFiles].filter((f) => f.endsWith('.csproj')).sort();
-  if (csprojNames.length === 0) return undefined;
-  return tryReadString(join(rootDir, csprojNames[0]!));
-}
-
-/**
- * Read `build.gradle.kts` (Kotlin DSL — modern default per Gradle 7+) if
- * present; otherwise fall back to `build.gradle` (legacy Groovy DSL).
- * Returns undefined if neither exists.
- */
-function tryReadGradleBuild(rootDir: string, presentFiles: Set<string>): string | undefined {
-  if (presentFiles.has('build.gradle.kts')) {
-    return tryReadString(join(rootDir, 'build.gradle.kts'));
-  }
-  if (presentFiles.has('build.gradle')) {
-    return tryReadString(join(rootDir, 'build.gradle'));
-  }
-  return undefined;
-}
-
-function tryReadString(path: string): string | undefined {
-  if (!existsSync(path)) return undefined;
-  try {
-    return readFileSync(path, 'utf-8');
-  } catch {
-    return undefined;
-  }
-}
-
-function tryReadJson(path: string): Record<string, unknown> | undefined {
-  const txt = tryReadString(path);
-  if (!txt) return undefined;
-  try {
-    const parsed = JSON.parse(txt);
-    return typeof parsed === 'object' && parsed !== null ? (parsed as Record<string, unknown>) : undefined;
-  } catch {
-    return undefined;
-  }
-}
-
-function tryReadToml(path: string): Record<string, unknown> | undefined {
-  const txt = tryReadString(path);
-  if (!txt) return undefined;
-  // Cheap signal-only parse: we just need top-level table presence + keys.
-  // Avoid pulling the full toml parser for this; check `[project]`/`[tool.x]`
-  // headers and treat `tool.poetry.dependencies` etc. as opaque text-search.
-  // Adapters that need structured data can grep `txt` themselves.
-  return { __raw: txt };
-}

package/src/detect/adapters/spring.ts

@@ -1,4 +0,0 @@
-// Plan 3c Phase 9b P-A-005: re-export shim. Source-of-truth lives at
-// `packages/adapter-spring/src/index.ts` (workspace package). This shim
-// preserves the legacy import path used by codebase-introspector + tests.
-export { springAdapter } from '@massu/adapter-spring';

package/src/detect/adapters/swift-swiftui.ts

@@ -1,171 +0,0 @@
-// Copyright (c) 2026 Massu. All rights reserved.
-// Licensed under BSL 1.1 - see LICENSE file for details.
-
-/**
- * Plan 3b — Phase 1: SwiftUI AST adapter.
- *
- * Extracts:
- *   - api_client_class: identifier ending in `API` (e.g. `HedgeAPI`)
- *   - biometric_policy: `LAPolicy.deviceOwnerAuthenticationWithBiometrics` etc.
- *   - navigation_pattern: 'NavigationStack' | 'NavigationView' | null
- *
- * Tree-sitter Swift grammar quirks: the `tree-sitter-swift` grammar names some
- * nodes differently from python/typescript. We use simpler, more permissive
- * S-expressions that fall back to capture-text matching where needed.
- */
-
-import { Parser } from 'web-tree-sitter';
-import type { CodebaseAdapter, AdapterResult, DetectionSignals, Provenance, SourceFile } from './types.ts';
-import { runQuery, InvalidQueryError } from './query-helpers.ts';
-import { loadGrammar } from './tree-sitter-loader.ts';
-import { isParsableSource, MAX_AST_FILE_BYTES } from './parse-guard.ts';
-
-// ============================================================
-// Queries
-// ============================================================
-
-/**
- * Identifier that looks like an API client class. Captures any uppercase-led
- * identifier ending in `API`. Predicate filtering is done in JS — Swift's
- * grammar doesn't surface a clean class-instantiation pattern uniformly.
- */
-const API_CLASS_QUERY = `
-(simple_identifier) @ident
-`;
-
-/**
- * `.deviceOwnerAuthentication` / `.deviceOwnerAuthenticationWithBiometrics`
- * member access. Captures the property name.
- */
-const POLICY_QUERY = `
-(navigation_expression
-  suffix: (navigation_suffix
-    (simple_identifier) @policy_name))
-`;
-
-/**
- * NavigationStack / NavigationView usage. Captures any reference to either
- * symbol.
- */
-const NAV_QUERY = `
-(simple_identifier) @nav_ident
-`;
-
-// ============================================================
-// Adapter
-// ============================================================
-
-const POLICY_NAMES = new Set([
-  'deviceOwnerAuthentication',
-  'deviceOwnerAuthenticationWithBiometrics',
-]);
-
-export const swiftSwiftUiAdapter: CodebaseAdapter = {
-  id: 'swift-swiftui',
-  languages: ['swift'],
-
-  matches(signals: DetectionSignals): boolean {
-    // Swift signal: presence of Package.swift, *.xcodeproj, or Sources/ dir
-    if (signals.presentFiles.has('Package.swift')) return true;
-    for (const dir of signals.presentDirs) {
-      if (dir.endsWith('.xcodeproj') || dir.endsWith('.xcworkspace')) return true;
-      if (dir === 'Sources') return true;
-    }
-    for (const file of signals.presentFiles) {
-      if (file.endsWith('.swift')) return true;
-    }
-    return false;
-  },
-
-  async introspect(files: SourceFile[], _rootDir: string): Promise<AdapterResult> {
-    if (files.length === 0) {
-      return { conventions: {}, provenance: [], confidence: 'none' };
-    }
-
-    let language;
-    try {
-      language = await loadGrammar('swift');
-    } catch {
-      return { conventions: {}, provenance: [], confidence: 'none' };
-    }
-
-    const parser = new Parser();
-    parser.setLanguage(language);
-
-    const apiClasses = new Map<string, { line: number; file: string }>();
-    const policies = new Map<string, { line: number; file: string }>();
-    const navs = new Map<string, { line: number; file: string }>();
-
-    try {
-      for (const file of files) {
-        const skip = isParsableSource(file.content, file.size);
-        if (skip) {
-          process.stderr.write(
-            `[massu/ast] WARN: swift-swiftui skipping ${file.path}: ${skip.reason} (${skip.detail}). Cap=${MAX_AST_FILE_BYTES}. (Phase 3.5 mitigation)\n`,
-          );
-          continue;
-        }
-        try {
-          // API class names: filter via JS regex on the captured identifier
-          for (const hit of runQuery(parser, file.content, API_CLASS_QUERY, 'swift-api-class', file.path)) {
-            const ident = hit.captures.ident;
-            if (ident && /^[A-Z][A-Za-z0-9_]*API$/.test(ident) && !apiClasses.has(ident)) {
-              apiClasses.set(ident, { line: hit.line, file: file.path });
-            }
-          }
-          // Biometric policy
-          for (const hit of runQuery(parser, file.content, POLICY_QUERY, 'swift-biometric-policy', file.path)) {
-            const name = hit.captures.policy_name;
-            if (name && POLICY_NAMES.has(name) && !policies.has(name)) {
-              policies.set(name, { line: hit.line, file: file.path });
-            }
-          }
-          // Navigation
-          for (const hit of runQuery(parser, file.content, NAV_QUERY, 'swift-navigation', file.path)) {
-            const ident = hit.captures.nav_ident;
-            if ((ident === 'NavigationStack' || ident === 'NavigationView') && !navs.has(ident)) {
-              navs.set(ident, { line: hit.line, file: file.path });
-            }
-          }
-        } catch (e) {
-          if (e instanceof InvalidQueryError) throw e;
-          continue;
-        }
-      }
-    } finally {
-      try { parser.delete(); } catch { /* ignore */ }
-    }
-
-    const conventions: Record<string, unknown> = {};
-    const provenance: Provenance[] = [];
-
-    if (apiClasses.size > 0) {
-      const [name, { line, file }] = apiClasses.entries().next().value as [string, { line: number; file: string }];
-      conventions.api_client_class = name;
-      provenance.push({ field: 'api_client_class', sourceFile: file, line, query: 'swift-api-class' });
-    }
-    if (policies.size > 0) {
-      const [name, { line, file }] = policies.entries().next().value as [string, { line: number; file: string }];
-      conventions.biometric_policy = name;
-      provenance.push({ field: 'biometric_policy', sourceFile: file, line, query: 'swift-biometric-policy' });
-    }
-    if (navs.size > 0) {
-      const [name, { line, file }] = navs.entries().next().value as [string, { line: number; file: string }];
-      conventions.navigation_pattern = name;
-      provenance.push({ field: 'navigation_pattern', sourceFile: file, line, query: 'swift-navigation' });
-    }
-
-    let confidence: AdapterResult['confidence'];
-    if (Object.keys(conventions).length === 0) {
-      confidence = 'none';
-    } else if (apiClasses.size === 1 && policies.size <= 1) {
-      confidence = 'high';
-    } else if (apiClasses.size > 1) {
-      confidence = 'low';
-    } else {
-      confidence = 'medium';
-    }
-
-    return { conventions, provenance, confidence };
-  },
-};